OA
Product
oauthlib
3
CVEs
0
On KEV
8.4
Max CVSS
3
New 30D
Severity mix
Critical 0High 1Medium 2Low 0
Watch
Add oauthlib to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-118669 New | 8.4 | Oct 28 | OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client Affected: < 4.0.0 |
| CVE-2026-49265 | 6.8 | Oct 13 | OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison Affected: >= 3.0.0, < 4.0.0 |
| CVE-2026-49264 | 6.1 | Oct 13 | OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation Affected: >= 0.6.1, < 4.0.0 |
Showing 3